{
  "id": "kubelogin",
  "name": "kubelogin",
  "homepage": "https://github.com/int128/kubelogin",
  "description": "A kubectl plugin for OpenID Connect authentication.",
  "executables": [
    "kubelogin"
  ],
  "dotfiles": {
    "paths": [],
    "secret": [
      "~/.kube/cache/oidc-login/"
    ]
  },
  "commands": {
    "format": 1,
    "label": "kubelogin",
    "description": "Fetch an OIDC token for kubectl with get-token. Password, client secret, TLS and logging options are left out.",
    "quality": "ai-draft",
    "parser": {
      "end_of_options": "--",
      "interleave": "permute",
      "long_equals": true,
      "short_attached": false,
      "short_bundles": false
    },
    "subcommand": [
      {
        "path": [
          "get-token"
        ],
        "label": "Get an OIDC token",
        "description": "Run the credential plugin for one OIDC provider. Normally kubectl invokes this from kubeconfig; use it to test a provider.",
        "source": [
          {
            "id": "usage",
            "kind": "help",
            "url": "https://raw.githubusercontent.com/int128/kubelogin/HEAD/docs/usage.md",
            "revision": "HEAD 2026-10-27",
            "evidence": "  kubelogin get-token [flags]\n      --oidc-issuer-url string                          Issuer URL of the provider (mandatory)\n      --oidc-client-id string                           Client ID of the provider (mandatory)\n      --oidc-extra-scope strings                        Scopes to request to the provider\n      --force-refresh                                   If set, refresh the ID token regardless of its expiration time\n      --token-cache-storage string                      Storage for the token cache. One of (disk|keyring|none) (default \"disk\")\n      --skip-open-browser                               [authcode] Do not open the browser automatically\n      --grant-type string                               Authorization grant type to use. One of (auto|authcode|authcode-keyboard|password|device-code|client-credentials) (default \"auto\")\n"
          }
        ],
        "field": [
          {
            "id": "issuer_url",
            "label": "Issuer URL",
            "type": "url",
            "option": [
              "--oidc-issuer-url"
            ],
            "sources": [
              "usage"
            ]
          },
          {
            "id": "client_id",
            "label": "Client ID",
            "type": "string",
            "option": [
              "--oidc-client-id"
            ],
            "sources": [
              "usage"
            ]
          },
          {
            "id": "extra_scope",
            "label": "Extra scope",
            "type": "string",
            "option": [
              "--oidc-extra-scope"
            ],
            "multiple": true,
            "sources": [
              "usage"
            ]
          },
          {
            "id": "grant_type",
            "label": "Grant type",
            "type": "enum",
            "option": [
              "--grant-type"
            ],
            "choices": [
              {
                "value": "auto",
                "label": "Auto"
              },
              {
                "value": "authcode",
                "label": "Authorization code"
              },
              {
                "value": "authcode-keyboard",
                "label": "Authorization code (keyboard)"
              },
              {
                "value": "password",
                "label": "Password"
              },
              {
                "value": "device-code",
                "label": "Device code"
              },
              {
                "value": "client-credentials",
                "label": "Client credentials"
              }
            ],
            "sources": [
              "usage"
            ]
          },
          {
            "id": "token_cache_storage",
            "label": "Token cache storage",
            "type": "enum",
            "option": [
              "--token-cache-storage"
            ],
            "choices": [
              {
                "value": "disk",
                "label": "Disk"
              },
              {
                "value": "keyring",
                "label": "Keyring"
              },
              {
                "value": "none",
                "label": "None"
              }
            ],
            "sources": [
              "usage"
            ]
          },
          {
            "id": "skip_open_browser",
            "label": "Do not open the browser",
            "type": "boolean",
            "option": [
              "--skip-open-browser"
            ],
            "sources": [
              "usage"
            ]
          },
          {
            "id": "force_refresh",
            "label": "Force token refresh",
            "type": "boolean",
            "option": [
              "--force-refresh"
            ],
            "sources": [
              "usage"
            ]
          }
        ],
        "task": [
          {
            "id": "get-token",
            "label": "Get a token",
            "fields": [
              "issuer_url",
              "client_id"
            ],
            "required": [
              "issuer_url",
              "client_id"
            ]
          }
        ],
        "group": [
          {
            "id": "basic",
            "label": "Basic",
            "fields": [
              "issuer_url",
              "client_id",
              "extra_scope",
              "grant_type"
            ]
          },
          {
            "id": "advanced",
            "label": "Advanced",
            "fields": [
              "token_cache_storage",
              "skip_open_browser",
              "force_refresh"
            ]
          }
        ]
      }
    ]
  }
}